Data location
Control plane, execution environments, code, and artifacts run where you deploy them. Connected model endpoints decide where request data travels — map each route. See data residency.
DEPLOYMENT SCENARIO · VERIFIED 2026-08-05
Regulated-industry AI coding: own the controls, keep the evidence.
Teams in finance, healthcare, and the public sector adopt AI coding under obligations most tools were not designed around: data residency, auditability, retention, and vendor risk. A self-hostable, open-source platform puts those controls on your side of the boundary — this page maps which ones, what evidence to produce, and what remains your responsibility. Nothing here is a certification or legal advice.
Why self-hostable matters here
The controls regulators ask about sit on your side.
Available is not automatic: every control below still has to be configured, tested, and evidenced in your deployment.
Egress and isolation
Outbound allowlists, network segmentation, and — where required — fully air-gapped operation are yours to enforce and monitor.
Auditability
Per-task execution logs, review gates, and credential records support the audit trail regulators expect. See architecture and trust boundaries.
License transparency
AGPL-3.0 source availability lets your security team inspect what runs. Obligations for modification or network service need qualified legal review.
Evidence pack
What a compliance review should receive.
Produce these from your own deployment; no vendor page can supply them for you.
01 · Data-flow map
Every boundary — source control, model endpoints, packages, logs, backups — with owner, credential, retention rule, and allowed path. Start from security and data-flow boundaries.
02 · Credential policy
Scope, expiry, and rotation for every credential an agent task can observe, with the revocation drill rehearsed.
03 · Review-gate record
Which actions require human approval — merges, deployments, dependency changes — and the log showing gates were enforced.
04 · Pilot results
A reproducible record of tasks, outcomes, review effort, and failures from a bounded pilot, using the pilot methodology and open dataset schema.
Regulatory context
Read the analyses, then take legal advice.
These are engineering-focused analyses with sources and limits — not legal counsel.
EU AI Act timeline
Which obligations reach AI coding-tool use, by role and date. Read the timeline.
Code privacy and governance
Keeping proprietary code private across tool categories, and governing unsanctioned use. Data-governance guide · shadow AI.
Ownership and licensing
Copyright of AI-generated code and AGPL-3.0 compliance questions to review with counsel. Ownership analysis · AGPL guide.
Security posture
OWASP-aligned controls for agents that execute code, and lessons from a disclosed agent-run intrusion. OWASP checklist · incident analysis.
Common questions
Regulated adoption, answered.
Related: proprietary code safety, external transmission, self-hosting privacy.
Is MonkeyCode certified for regulated industries?
This site makes no certification claims. MonkeyCode is an open-source platform (AGPL-3.0) whose public documentation describes private and offline deployment. Whether a specific deployment meets your regulatory obligations depends on how you configure, operate, and audit it — and on your own compliance review.
Why do regulated teams consider self-hosted AI coding platforms?
Because the controls regulators care about — data location, egress, credentials, logging, retention, and reviewability — sit on your side in a self-hosted deployment. Control is available, not automatic: each of those must still be configured and evidenced.
Does the EU AI Act apply to teams using AI coding tools?
The EU AI Act primarily regulates providers and deployers of AI systems by risk class; most coding-assistant use falls outside the high-risk categories, but obligations depend on your role and use case. See our EU AI Act timeline analysis and take legal advice — this site is not legal counsel.
What evidence should a compliance review ask for?
A data-flow map with owners for every boundary (source control, model endpoints, logs, backups), per-task execution logs, credential scope and rotation policy, egress records, and a reproducible record of pilot results. Marketing statements are not evidence.
Can proprietary code stay inside our boundary?
Self-hosting gives you the ability to keep code, prompts, and artifacts inside your network, but connected model endpoints determine where request data actually travels. Verify each route — see the direct answers on code privacy and external transmission.
START WITH EVIDENCE